EP3288233B1 - Programme de commande de stockage de supports d'enregistrement lisibles par ordinateur non transitoires, procédé de commande et dispositif de traitement d'informations - Google Patents

Programme de commande de stockage de supports d'enregistrement lisibles par ordinateur non transitoires, procédé de commande et dispositif de traitement d'informations Download PDF

Info

Publication number
EP3288233B1
EP3288233B1 EP17183753.7A EP17183753A EP3288233B1 EP 3288233 B1 EP3288233 B1 EP 3288233B1 EP 17183753 A EP17183753 A EP 17183753A EP 3288233 B1 EP3288233 B1 EP 3288233B1
Authority
EP
European Patent Office
Prior art keywords
information
cyber attack
node
attack event
event information
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP17183753.7A
Other languages
German (de)
English (en)
Other versions
EP3288233A1 (fr
Inventor
Koji Yamada
Kunihiko Yoshimura
Kouta Tanabe
Toshitaka Satomi
Ryusuke Masuoka
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Fujitsu Ltd
Original Assignee
Fujitsu Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Fujitsu Ltd filed Critical Fujitsu Ltd
Publication of EP3288233A1 publication Critical patent/EP3288233A1/fr
Application granted granted Critical
Publication of EP3288233B1 publication Critical patent/EP3288233B1/fr
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/577—Assessing vulnerabilities and evaluating computer system security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0414—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Definitions

  • the embodiments discussed herein relate to a non-transitory computer-readable recording medium storing a control program, a control method, and an information processing device.
  • Cyber attacks such as unauthorized access through a network are made.
  • EP 3038 005 A1 discloses an alert transmission method. Behavior logs of multiple users are collected from multiple terminals. A computer groups users having a high similarity to each other based on the behavior logs. An alert is transmitted to other users belonging to a group of a user indicated by a report of a cyber attack, when receiving the report from a terminal of the user.
  • a non-transitory computer-readable recording medium storing a control program in accordance with Claim 1.
  • the present invention also provides a control method in accordance with claim 5.
  • the present invention also provides an information processing device in accordance with claim 9.
  • a method for controlling the range of providing an information category of the information about cyber attack may be provided.
  • an authentication system of a security information disclosure site that releases security information about vulnerability of an application and actions against the vulnerability is provided in order to provide information about cyber attacks.
  • a network connection device is requested to transmit security authentication information, and is coupled in accordance with a result of comparing the security authentication information transmitted thereafter.
  • security information is directly disclosed to the network connection device coupled in accordance with the result of comparing the security authentication information.
  • an information category including personal information may be disclosed and a person may be specified.
  • a method for controlling the range of providing an information category of the information about cyber attack may be provided.
  • any components having substantially identical or similar functions are denoted by the same reference sign, and any duplicate description thereof may be omitted in some cases.
  • the following disclosure is merely exemplary and not intended to limit the embodiments. Further, embodiments described below may be combined as appropriate within a range of no contradiction.
  • FIG. 1 illustrates an exemplary analysis support system.
  • the analysis support system 1 includes a client terminal 2 and a server device 3.
  • the client terminal 2 and the server device 3 are coupled to each other to be capable of performing communication through a communication network such as the Internet or a local area network (LAN).
  • a communication network such as the Internet or a local area network (LAN).
  • LAN local area network
  • the client terminal 2 is a terminal device used by a user, and may be, for example, a personal computer (PC) or a tablet terminal.
  • the client terminal 2 includes a client terminal 2a configured to perform, to the server device 3, registration of cyber attack event information 4 about a cyber attack event, and setting of a rule (policy) on a range in which the cyber attack event information 4 is provided. Further, the client terminal 2 may include client terminals 2b and 2c configured to, in accordance with the policy, receive the provided cyber attack event information 4 registered to the server device 3.
  • the server device 3 transmits, to the client terminal 2a, display information about a setting screen on which the registration of the cyber attack event information 4 and the setting of a policy on the range of providing the cyber attack event information 4 are performed.
  • the client terminal 2a displays, based on the display information, the setting screen on a display unit 20 such as a liquid crystal display.
  • the client terminal 2a receives, through an operation unit 21 that is a user interface such as an operation key or a touch panel, operation instructions on the registration of the cyber attack event information 4 and the setting of a policy, and transmits, to the server device 3, the cyber attack event information 4 to be registered and information on the setting of a policy.
  • the server device 3 registers the cyber attack event information 4 received from the client terminal 2a to a cyber attack event information DB 5.
  • the server device 3 registers, to setting information 6, setting of a policy on the range of providing the cyber attack event information 4 based on the information on the setting of a policy, which is received from the client terminal 2a.
  • the server device 3 reads the cyber attack event information 4 registered to the cyber attack event information DB 5 in response to a transmission request from the client terminal 2a or the client terminals 2b and 2c.
  • the server device 3 provides the cyber attack event information 4 to the client terminals 2b and 2c in accordance with a policy registered to the setting information 6.
  • the client terminals 2a to 2c may share the cyber attack event information 4 about cyber attacks and may proceed with analyze the cyber attacks.
  • the cyber attack event information 4 is information indicating a cyber attack activity (also referred to as Campaigns) related to a detected cyber attack event, such as detection of malware in an information processing system to be monitored.
  • the cyber attack event information 4 may be described in, for example, a Structured Threat Information expression (STIX) language in accordance with Structured Threat Information expression (STIX), which is technical specification for describing an item related to a cyber attack activity including an event that characterizes a cyber attack.
  • STIX Structured Threat Information expression
  • the cyber attack event information 4 may include, in addition to a cyber attack activity (Campaigns), an event content for each type (information category) of an attacker (Threat_Actors), an attack tactics (TTPs), a detection indicator (Indicators), an observation event (Observables), an incident (Incidents), an action (Courses_Of_Action), and an attack target (Exploit_Targets).
  • the TTP is an abbreviation for Tactics, Techniques and Procedures.
  • Content, in addition to a cyber attack activity, included in the cyber attack event information 4 may be information on part or all of an attacker, an attack tactics, a detection indicator, an observation event, an incident, an action, and an attack target.
  • FIG. 2 illustrates exemplary cyber attack event information.
  • the cyber attack event information 4 includes fields 40a and 40j for additional information about STIX_ Header and Related_ Packages, and fields 40b to 40i for information about each item related to a cyber attack activity.
  • the fields 40a to 40j are associated with each other through a link.
  • the field 40h for a cyber attack activity (Campaigns) is linked to the field for each item, such as the field 40c, 40d, 40f, 40i, or 40j.
  • the field 40h for a cyber attack activity (Campaigns) describes, for example, intention of the cyber attack activity of interest and the status of the attack activity.
  • the field 40h individually describes information about intention (Intended_Effect) of a cyber attack activity/an attacker.
  • the field 40h individually describes the status of an attack activity (campaign:Status).
  • the field 40i for an attacker individually describes information about a person/organization contributing to a cyber attack in terms of the type of an attacker of the cyber attack, motivation of the attacker, a level of the skill of the attacker, or intention of the attacker.
  • the field 40i describes, for example, information such as an IP address, mail address, or social network service account of an unauthorized access source (transmission source).
  • the field 40d for an attack tactics individually describes information about an attack pattern, a resource such as a malware or tool used by an attacker, an attack infrastructure of the attacker, or an attack target.
  • the attack pattern (ttp:Attack_Pattern) may be described by using Common Attack Pattern Enumeration and Classification (CAPEC).
  • CAPEC Common Attack Pattern Enumeration and Classification
  • the field 40d may describe at least one of information about an IP address allocated to an information processing device involved in a cyber attack, and information about an access destination from the information processing device.
  • the field 40c for a detection indicator individually describes information indicating an indicator characterizing a cyber attack event.
  • the field 40c describes an indicator characterizing a cyber attack in addition to a tool used to produce the detection indicator from, for example, a type of a detection indicator, an observation event related to the detection indicator, an attack stage phase, or a signature.
  • the field 40b for an observation event individually describes information indicating an event related to an operation observed in a cyber attack event.
  • the field 40b describes, as an event observed in a cyber attack, a file name, a hash value, a file size, a registry value, a service in operation, or a HTTP request.
  • the description may use CybOX, which is a specification for describing an observation event of a cyber attack.
  • the field 40f for an incident individually describes information about a case occurring with a cyber attack in terms of, for example, a category describing the incident, persons (a reporter, a responder, a coordinator, and a victim) involved in the incident, an asset (a possessor, an administrator, and a place) damaged by the incident, direct/indirect influence by the incident, or the status of an action against the incident.
  • the field 40f individually describes information about the possessor or administrator of an asset damaged by an attacker of a cyber attack, and the place of the asset.
  • the field 40g for an action (Courses_Of_Action) individually describes information indicating an action against a threat of a cyber attack event in terms of, for example, the status of an action against the incident, the type of the action, the purpose of the action, influence of the action, cost of the action, or effectiveness of the action.
  • the field 40e for an attack target individually describes information indicating a weak point of an asset to be attacked in a cyber attack event, such as a weak point or the like of software or a system, which may be attacked in terms of, for example, vulnerability, the kind of the vulnerability, setting, or a configuration.
  • the field 40e describes vulnerability by using Common Vulnerability and Exposures (CVE).
  • CVE Common Vulnerability and Exposures
  • CE Common Weakness Enumeration
  • CE Common Configuration Enumeration
  • FIG. 3 illustrates exemplary cyber attack event information.
  • the cyber attack event information 4 employs an eXtensible Markup Language (XML) format to describe the above-described information in a tree structure in which tagged elements are hierarchized (formed in a nesting structure) from root elements.
  • XML eXtensible Markup Language
  • the cyber attack event information 4 describes a tree structure in which a cyber attack activity, an attacker, an attack tactics, a detection indicator, an observation event, an incident, an action against the incident, an attack target or the like of a cyber attack event are set as elements, and information in each element is set as a subelement.
  • FIG. 4 illustrates an exemplary functional configuration of the server device.
  • the server device 3 includes a setting screen display unit 30, an input unit 31, a registration unit 32, a storage unit 33, a transmission unit 34, and a transmission control unit 35.
  • the setting screen display unit 30 generates display information about the setting screen on which the registration of the cyber attack event information 4 and the setting of a policy on the range of providing the cyber attack event information 4 are performed, and transmits the display information to the client terminal 2a.
  • the client terminal 2a displays, based on the display information transmitted from the setting screen display unit 30, on the display unit 20, the setting screen on which the registration of the cyber attack event information 4 or the setting of a policy on the range of providing the cyber attack event information 4 is performed.
  • the input unit 31 receives input of information transmitted from the client terminal 2 through, for example, the communication network.
  • the input unit 31 receives the cyber attack event information 4 as a registration target transmitted from the client terminal 2, and operation information.
  • the operation information is information corresponding to an operation instruction received by the client terminal 2 from the user through the operation unit 21.
  • the operation information may include the information about the setting of a policy on the range of providing the cyber attack event information 4, which is received by the client terminal 2a.
  • the operation information may include information about a request to transmit the cyber attack event information 4 stored in the cyber attack event information DB 5, which is received by the client terminal 2a, or the client terminals 2b and 2c.
  • the input unit 31 outputs, to the registration unit 32, the cyber attack event information 4 as a registration target received from the client terminal 2a, and the information about the setting of a policy on the range of providing the cyber attack event information 4.
  • the input unit 31 outputs, to the transmission unit 34, the information about the request to transmit the cyber attack event information 4 stored in the cyber attack event information DB 5, which is received from the client terminals 2a to 2c.
  • the registration unit 32 registers, to the cyber attack event information DB 5 in the storage unit 33, the cyber attack event information 4 as a registration target received from the client terminal 2a.
  • the registration unit 32 registers to the setting information 6 in the storage unit 33 (updates the setting information 6 in the storage unit 33 with) the information about the setting of a policy on the range of providing the cyber attack event information 4 which is received from the client terminal 2a.
  • the storage unit 33 may be a storage device such as a hard disk device 509 (refer to FIG. 9 ), and stores therein the cyber attack event information DB 5 and the setting information 6.
  • the cyber attack event information DB 5 is a database (DB) that allows registration and search of data.
  • the cyber attack event information 4 received from the client terminal 2a is given, for example, an identifier (ID) by the registration unit 32 and registered to the cyber attack event information DB 5.
  • ID an identifier
  • the setting information 6 may be information indicating various setting contents input from the client terminal 2 through the input unit 31 and registered by the registration unit 32.
  • the setting information 6 may include the information about the setting of a policy on the range of providing the cyber attack event information 4.
  • the setting of a policy in the setting information 6 may be performed with a policy on the entire analysis support system 1 or with a policy of each cyber attack event information 4.
  • the information about the setting of a policy is registered, by the registration unit 32, to the setting information 6 together with the identifier (ID) of the cyber attack event information 4 registered to the cyber attack event information DB 5.
  • FIG. 5 illustrates an exemplary operation of the server device.
  • FIG. 5 illustrates an operation on registration of the setting of a policy.
  • the setting screen display unit 30 when processing is started, the setting screen display unit 30 generates the display information about the setting screen on which the setting of a policy on the range of providing the cyber attack event information 4 is performed, and outputs the display information to the client terminal 2a.
  • the client terminal 2a displays the setting screen on the display unit 20 based on the display information from the setting screen display unit 30 (S1).
  • the input unit 31 receives the operation information input on the setting screen through the client terminal 2a (S2).
  • FIG. 6 illustrates an exemplary setting screen. As illustrated in FIG. 6 , this setting screen 200 includes a console 201, a policy selection region 210, a policy display region 220, and a setting icon display region 230.
  • the console 201 may be, for example, a mouse cursor operated in response to the operation information received through the operation unit 21 by the client terminal 2a.
  • the policy selection region 210 is a region in which a list of any policy set (registered) to the setting information 6 is displayed and selection is received.
  • the setting screen display unit 30 refers to the setting information 6 in the storage unit 33 and generates display information for displaying a list of any set policy in the policy selection region 210. In the case where there is a policy selected by the console 201 in the policy selection region 210, the setting screen display unit 30 reads the setting information 6 of the selected policy from the storage unit 33. The setting screen display unit 30 generates, based on the read setting information 6, display information for displaying the content of the selected policy in the policy display region 220.
  • the policy display region 220 is a region in which the content of a policy on the range of providing the cyber attack event information 4 is displayed in a tree structure from a root node to an end node.
  • a rule node 301 indicating one policy named "Rule_PII" is set as a root, and is coupled and associated, through a connection line, with an access destination rule node 302 that sets a policy of an access destination with respect to the root.
  • the access destination rule node 302 is associated with access destination nodes 302a and 302b through connection lines.
  • This tree structure form the rule node 301 to the access destination nodes 302a and 302b indicates an access destination to which the cyber attack event information 4 is allowed to be provided with respect to one policy named "Rule_Pll".
  • the rule node 301 as a root is coupled and associated, through a connection line, with an information category rule node 303 that sets a target of mask processing, for example, anonymization processing.
  • the information category rule node 303 is associated, through connection lines, with a mask processing node 304 representing the content of the mask processing, and information category nodes 303a to 303d each representing an information category as a target of the mask processing.
  • This tree structure from the rule node 301 as a root to the mask processing node 304 and the information category nodes 303a to 303d indicates, with respect to one policy named "Rule_Pll", the content of the mask processing performed when the cyber attack event information 4 is provided, and the information category as a target of the mask processing.
  • a rule node 311 representing one policy named "Rule_infra” is set as a root, and is coupled and associated, through a connection line, to an access destination rule node 312 that sets a policy of an access destination with respect to the root.
  • the access destination rule node 312 is associated with an access destination node 312a through a connection line.
  • This tree structure from the rule node 311 as a root to the access destination node 312a indicates an access destination to which the cyber attack event information 4 is allowed to be provided with respect to one policy named "Rule_infra".
  • the rule node 311 as a root is coupled and associated, through a connection line, to an information category rule node 313 that sets a target of the mask processing.
  • the information category rule node 313 is associated, through connection lines, with a mask processing node 314 representing the content of the mask processing, and an information category nodes 313a and 313b each representing an information category as a target of the mask processing.
  • This tree structure from the rule node 311 as a root to the mask processing node 314 and the information category nodes 313a and 313b indicates, with respect to one policy named "Rule_infra", the content of the mask processing performed when the cyber attack event information 4 is provided, and the information category as a target of the mask processing.
  • the policy display region 220 may display the content of one policy to be set, for example, a tree structure including the rule node 301 as a root, or may display the contents of multiple policies side by side as illustrated in FIG. 6 .
  • the setting icon display region 230 is a region displaying a setting icon 231 that performs setting of each node in the policy display region 220.
  • the setting icon 231 performs the setting of a policy by being coupled to the access destination rule nodes 302 and 312, the information category rule node 303, or the information category rule node 313.
  • the user selects a certain setting icon 231 through the console 201.
  • the user performs an operation (for example, drag and drop operation) to couple the selected setting icon 231 to the access destination rule nodes 302 and 312, the information category rule node 303, or the information category rule node 313 in the policy display region 220.
  • the access destination node 302a corresponding to "GOVERNMENT_Community” is added to a policy of an allowed access destination.
  • an access destination node 302b corresponding to "INDUSTRY_Community” is added to the policy of an allowed access destination. In this manner, the policies of multiple access destinations are set to the access destination rule node 302.
  • the mask processing node 304 corresponding to "REDACT_Pll” is added to a policy of mask processing.
  • the setting icon 231 representing the information category of an incident (Incidents) named "incidentModel” is selected and added to the information category rule node 303
  • an information category node 303a corresponding to the incident is added to the policy of mask processing.
  • the mask processing corresponding to the mask processing node 304 is applied in common with respect to multiple information categories such as a cyber attack activity, a detection indicator, or an attacker.
  • the content of a policy in the policy display region 220 is deleted when a node to be deleted is selected through the console 201 and a deletion instruction is performed. For example, when the access destination node 302a is selected through the console 201 and the deletion instruction is performed, a policy that allows an access destination named "GOVERNMENT_Community" is deleted.
  • the input unit 31 determines, based on the operation information from the client terminal 2a, whether setting with a content displayed on the setting screen 200 is registered (S3). If there is no operation instruction to register the setting with the content displayed on the setting screen 200 (No at S3), the input unit 31 returns the process to S1 and continues the setting through the setting screen 200.
  • the registration unit 32 registers the content of a policy displayed in the policy display region 220 to the setting information 6 and updates the setting information 6 (S5). For example, the registration unit 32 converts the content of a policy represented in a tree structure from a root node to an end node, into the corresponding XML format data of the tree structure, and registers the converted content to the setting information 6. If a policy is set for each cyber attack event information 4, the XML format data obtained through the conversion is, together with the identifier (ID) of the cyber attack event information 4, registered to the setting information 6.
  • ID identifier
  • the transmission unit 34 reads the cyber attack event information 4 from the cyber attack event information DB 5 based on the information about a request to transmit the cyber attack event information 4 stored in the cyber attack event information DB 5, which is received from the client terminals 2a to 2c, and transmits the requested cyber attack event information 4.
  • the transmission control unit 35 may control the transmission of the cyber attack event information 4 by the transmission unit 34.
  • the transmission control unit 35 refers to a policy registered to the setting information 6 and performs control to transmit the cyber attack event information 4 within a providing range indicated by the registered policy.
  • FIG. 7 illustrates an exemplary operation of the server device.
  • FIG. 7 illustrates an operation of transmitting the cyber attack event information 4.
  • the transmission unit 34 determines whether there is a request to transmit the cyber attack event information 4 (S10). If there is no transmission request (No at S10), the transmission unit 34 causes the process to stand by.
  • the transmission unit 34 acquires, from the cyber attack event information DB 5 based on an identifier or the like, the cyber attack event information 4 requested to be transmitted (S11).
  • the transmission control unit 35 acquires the setting information 6 (S12) to obtain a policy of transmission of the cyber attack event information 4. If a policy is set for each cyber attack event information 4, the transmission control unit 35 acquires, from the setting information 6 based on the identifier of the cyber attack event information 4 requested to be transmitted, a policy registered together with the identifier.
  • the transmission control unit 35 determines, based on the acquired policy, whether a destination to which the transmission is requested is a destination to which the transmission is allowed (S13). For example, if the destination to which the transmission is requested is included in an access destination node coupled to an access destination rule node, the transmission control unit 35 determines that the destination is a destination to which the transmission is allowed.
  • the transmission control unit 35 causes the transmission unit 34 to transmit an error (S14).
  • the destination to which the transmission is requested is not a destination allowed by a policy in the setting information 6, the error is transmitted and the transmission of the cyber attack event information 4 is rejected.
  • the transmission control unit 35 determines, based on the acquired policy, whether there is an information category to be masked (S15). For example, if an information category node is coupled to an information category rule node, the transmission control unit 35 determines that there is an information category to be masked. If there is no information category to be masked (No at S15), the transmission control unit 35 advances the process to S18.
  • the transmission control unit 35 specifies mask processing for the information category to be masked, to the transmission unit 34, based on the acquired policy (S16). For example, the transmission control unit 35 specifies, to the transmission unit 34, the content of mask processing corresponding to a mask processing node coupled to an information category rule node, to be performed on an information category corresponding to an information category node.
  • the mask processing may include processing of anonymizing personal information such as a mail address or an IP address included in an information category as a target.
  • the transmission unit 34 executes the specified mask processing on the information category specified by the transmission control unit 35 (S17).
  • the transmission control unit 35 causes the transmission unit 34 to transmit the cyber attack event information 4 (S18). If the mask processing is executed, the cyber attack event information 4 with the mask processing is transmitted.
  • FIG. 8 illustrates exemplary mask processing on cyber attack event information.
  • cyber attack event information 4A is the cyber attack event information before the mask processing is provided
  • cyber attack event information 4B is the cyber attack event information after the mask processing is executed.
  • mask processing set as a policy may be processing of anonymizing a mail address.
  • a mail address 401A in the cyber attack event information 4A before the mask processing becomes an anonymized mail address 401B in the cyber attack event information 4B after the mask processing.
  • Time information 402A for which no policy of mask processing is set is left as time information 402B, not anonymized in the cyber attack event information 4B after the mask processing.
  • the cyber attack event information 4 is provided as it is, based on a policy in the setting information 6, to a destination to which transmission is allowed if no information category to be masked is set in the policy. With respect to an information category set to be masked in the policy, the cyber attack event information 4 with the mask processing executed on the information category is provided. In this manner, the server device 3 may control the range of providing each information category of the cyber attack event information 4 related to cyber attacks.
  • the server device 3 receives registration of a node representing an access destination such that the node is associated with an access destination rule node, and receives, from the client terminal 2a, registration of a mask processing node representing specific mask processing on information and an information category node representing an information category such that the mask processing node and the information category node are associated with an information category rule node.
  • the server device 3 allows transmission of the cyber attack event information 4 to an access destination indicated by the node registered in association with the access destination rule node.
  • the server device 3 transmits the cyber attack event information 4, the server device 3 performs control such that the specific mask processing corresponding to the mask processing node registered in association with the information category rule node is executed on the information belonging to the information category node registered in association with the information category rule node, and then provides the resultant information to a destination.
  • the server device 3 may control the range of providing an information category of the cyber attack event information 4 to the destination. For example, it may be possible to reduce leakage of personal information by masking an information category including personal information.
  • All or any part of the various kinds of processing functions performed by the server device 3 may be executed on a CPU (or microcomputer such as micro processing unit (MPU) or micro controller unit (MCU)). All or any part of the various kinds of processing functions may be executed on a computer program analyzed and executed by a CPU (or microcomputer such as MPU or MCU), or on wired logic hardware.
  • the various kinds of processing functions performed by the server device 3 may be executed through cooperation of multiple computers based on cloud computing.
  • the analysis support system 1 of a client-server (C/S) model including the client terminal 2 and the server device 3 is provided.
  • the analysis support system 1 may have a device configuration including the client terminal 2a alone, in which the client terminal 2a executes various kinds of processing functions of the server device 3.
  • FIG. 9 illustrates an exemplary hardware configuration of the server device.
  • the server device 3 includes a CPU 501 configured to execute various kinds of arithmetic processing, an input device 502 configured to receive data input, a monitor 503, and a speaker 504.
  • the server device 3 includes a medium read device 505 configured to read, for example, a computer program from a storage medium, an interface device 506 for connection to various devices, and a communication device 507 for connection to achieve communication with external equipment in a wired or wireless manner.
  • the server device 3 includes a RAM 508 configured to temporarily store various kinds of information, and the hard disk device 509. Each component (501 to 509) inside the server device 3 is coupled to a bus 510.
  • the hard disk device 509 stores therein a computer program 511 for executing various kinds of processing at the input unit 31, the registration unit 32, the transmission unit 34, and the transmission control unit 35 described above.
  • the hard disk device 509 stores therein various kinds of data 512 to be referred to by the computer program 511, for example, the cyber attack event information DB 5.
  • the input device 502 receives, for example, inputting of operation information from an operator.
  • the monitor 503 displays, for example, various screens to be operated by the operator.
  • the interface device 506 is coupled to, for example, a printing device.
  • the communication device 507 is connected to the communication network such as a local area network (LAN) to transmit and receive various kinds of information to and from an external instrument through the communication network.
  • LAN local area network
  • the CPU 501 performs various kinds of processing by reading the computer program 511 stored in in the hard disk device 509, loading the computer program 511 onto the RAM 508, and executing the computer program 511.
  • the computer program 511 may not have to be stored in the hard disk device 509.
  • the computer program 511 stored in a storage medium readable by the server device 3 may be read and executed.
  • the storage medium readable by the server device 3 may be, for example, a portable recording medium such as a CD-ROM, a DVD disk, or a Universal Serial Bus (USB) memory, a semiconductor memory such as a flash memory, or a hard disk drive.
  • the computer program 511 may be stored in a device coupled to a public line, the Internet, a LAN or the like to allow the server device 3 to read the computer program 511 from the device and execute the computer program 511.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computing Systems (AREA)
  • General Physics & Mathematics (AREA)
  • Physics & Mathematics (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Claims (12)

  1. Programme de commande amenant un ordinateur à exécuter un traitement, le traitement comprenant :
    l'affichage (S1) d'un nœud de règles (301, 311), d'un premier nœud (302, 312) lié à une destination d'accès (302a, 302b) à laquelle il est permis de fournir des informations d'événement de cyber-attaque et d'un second nœud (303, 313) lié à une ou plusieurs catégories d'informations (303a-303d) destinées à être une cible d'un traitement par masque ;
    quand une transmission des informations d'événement de cyber-attaque est effectuée sur la base d'une demande de transmission pour transmettre les informations d'événement de cyber-attaque à partir d'un terminal comme une destination de transmission, l'exécution (S17), dans un cas où la destination de transmission est incluse dans la destination d'accès (302a, 302b) fournie par le premier nœud (302, 312) couplé au nœud de règles (301, 311), d'un traitement par masque sur des informations qui sont incluses dans les informations d'événement de cyber-attaque et appartiennent aux une ou plusieurs catégories d'informations (303a-303d) fournies par le second nœud (303, 313) couplé au nœud de règles (301, 311) ; et
    la fourniture (S18) des informations d'événement de cyber-attaque, après que le traitement par masque est effectué, à la destination de transmission.
  2. Programme de commande selon la revendication 1, dans lequel
    une pluralité de nœuds sont autorisés à être enregistrés comme la destination d'accès (302a, 302b) en association avec le premier nœud (302, 312).
  3. Programme de commande selon la revendication 1, dans lequel
    dans un cas où une pluralité de nœuds sont enregistrés comme les une ou plusieurs catégories d'informations (303a-303d) en association avec le second nœud (303, 313), le traitement par masque est effectué sur des informations qui appartiennent à la totalité de la pluralité de nœuds comme les une ou plusieurs catégories d'informations (303a-303d), et les informations d'événement de cyber-attaque sont fournies après le traitement par masque à la destination de transmission.
  4. Programme de commande selon la revendication 1, dans lequel
    le traitement par masque est un traitement d'anonymisation des informations incluses dans les une ou plusieurs catégories d'informations (303a-303d).
  5. Procédé de commande comprenant :
    l'affichage (S1), par un ordinateur, d'un nœud de règles (301, 311), d'un premier nœud (302, 312) lié à une destination d'accès (302a, 302b) à laquelle il est permis de fournir des informations d'événement de cyber-attaque et d'un second nœud (303, 313) lié à une ou plusieurs catégories d'informations (303a-303d) destinées à être une cible d'un traitement par masque ;
    quand une transmission des informations d'événement de cyber-attaque est effectuée sur la base d'une demande de transmission pour transmettre les informations d'événement de cyber-attaque à partir d'un terminal comme une destination de transmission, l'exécution (S17), dans un cas où la destination de transmission est incluse dans la destination d'accès (302a, 302b) fournie par le premier nœud (302, 312) couplé au nœud de règles (301, 311), d'un traitement par masque sur des informations qui sont incluses dans les informations d'événement de cyber-attaque et appartiennent aux une ou plusieurs catégories d'informations (303a-303d) fournies par le second nœud (303, 313) couplé au nœud de règles (301, 311) ; et
    la fourniture (S18) des informations d'événement de cyber-attaque, après que le traitement par masque est effectué, à la destination de transmission.
  6. Procédé de commande selon la revendication 5, dans lequel
    une pluralité de nœuds sont autorisés à être enregistrés comme la destination d'accès (302a, 302b) en association avec le premier nœud (302, 312).
  7. Procédé de commande selon la revendication 5, comprenant en outre :
    l'exécution (S17), dans un cas où une pluralité de nœuds sont enregistrés comme les une ou plusieurs catégories d'informations (303a-303d) en association avec le second nœud, du traitement par masque sur des informations qui appartiennent à la totalité de la pluralité de nœuds comme les une ou plusieurs catégories d'informations (303a-303d) ; et
    la fourniture des informations d'événement de cyber-attaque après le traitement par masque à la destination de transmission.
  8. Procédé de commande selon la revendication 6, dans lequel
    le traitement par masque est un traitement d'anonymisation des informations incluses dans les une ou plusieurs catégories d'informations (303a-303d).
  9. Dispositif de traitement d'informations (3) comprenant :
    une mémoire (509) configurée pour stocker un programme de commande (511) ; et
    un processeur (501) configuré pour effectuer un traitement sur la base du programme de commande (511),
    dans lequel le traitement inclut :
    l'affichage (S1) d'un nœud de règles (301, 311), d'un premier nœud (302, 312) lié à une destination d'accès (302a, 302b) à laquelle il est permis de fournir des informations d'événement de cyber-attaque et d'un second nœud (303, 313) lié à une ou plusieurs catégories d'informations (303a-303d) destinées à être une cible d'un traitement par masque ;
    quand une transmission des informations d'événement de cyber-attaque est effectuée sur la base d'une demande de transmission pour transmettre les informations d'événement de cyber-attaque à partir d'un terminal comme une destination de transmission, l'exécution (S17), dans un cas où la destination de transmission est incluse dans la destination d'accès (302a, 302b) fournie par le premier nœud (302, 312) couplé au nœud de règles (301, 311), d'un traitement par masque sur des informations qui sont incluses dans les informations d'événement de cyber-attaque et appartiennent aux une ou plusieurs catégories d'informations (303a-303d) fournies par le second nœud (303, 313) couplé au nœud de règles (301, 311) ; et
    la fourniture (S18) des informations d'événement de cyber-attaque, après que le traitement par masque est effectué, à la destination de transmission.
  10. Dispositif de traitement d'informations selon la revendication 9, dans lequel
    une pluralité de nœuds sont autorisés à être enregistrés comme le nœud de destination d'accès (302a, 302b) en association avec le premier nœud (302, 312).
  11. Dispositif de traitement d'informations selon la revendication 9, dans lequel
    dans un cas où une pluralité de nœuds sont enregistrés comme les une ou plusieurs catégories d'informations (303a-303d) en association avec le second nœud (303, 313), le traitement par masque est effectué sur des informations qui appartiennent à la totalité de la pluralité de nœuds comme les une ou plusieurs catégories d'informations (303a-303d), et les informations d'événement de cyber-attaque sont fournies après le traitement par masque à la destination de transmission.
  12. Dispositif de traitement d'informations selon la revendication 9, dans lequel
    le traitement par masque est un traitement d'anonymisation des informations incluses dans les une ou plusieurs catégories d'informations (303a-303d).
EP17183753.7A 2016-08-26 2017-07-28 Programme de commande de stockage de supports d'enregistrement lisibles par ordinateur non transitoires, procédé de commande et dispositif de traitement d'informations Active EP3288233B1 (fr)

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
JP2016166305A JP6690469B2 (ja) 2016-08-26 2016-08-26 制御プログラム、制御方法および情報処理装置

Publications (2)

Publication Number Publication Date
EP3288233A1 EP3288233A1 (fr) 2018-02-28
EP3288233B1 true EP3288233B1 (fr) 2020-04-29

Family

ID=59501277

Family Applications (1)

Application Number Title Priority Date Filing Date
EP17183753.7A Active EP3288233B1 (fr) 2016-08-26 2017-07-28 Programme de commande de stockage de supports d'enregistrement lisibles par ordinateur non transitoires, procédé de commande et dispositif de traitement d'informations

Country Status (4)

Country Link
US (1) US10560467B2 (fr)
EP (1) EP3288233B1 (fr)
JP (1) JP6690469B2 (fr)
SG (1) SG10201706105WA (fr)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP6984754B2 (ja) * 2018-07-19 2021-12-22 富士通株式会社 サイバー攻撃情報分析プログラム、サイバー攻撃情報分析方法および情報処理装置
US11741196B2 (en) 2018-11-15 2023-08-29 The Research Foundation For The State University Of New York Detecting and preventing exploits of software vulnerability using instruction tags
CN111639033B (zh) * 2020-06-03 2021-11-02 厦门力含信息技术服务有限公司 软件安全威胁分析方法与系统
US11914630B2 (en) * 2021-09-30 2024-02-27 Paypal, Inc. Classifier determination through label function creation and unsupervised learning

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPS4816920B1 (fr) 1968-05-21 1973-05-25
JP2003248780A (ja) 2002-02-25 2003-09-05 Fujitsu Ltd 購買情報管理システム，購買情報匿名化サーバおよび購買情報管理方法
US7246156B2 (en) * 2003-06-09 2007-07-17 Industrial Defender, Inc. Method and computer program product for monitoring an industrial network
JP4816920B2 (ja) 2006-03-28 2011-11-16 日本電気株式会社 認証システムおよび認証方法
US7583187B1 (en) * 2006-07-11 2009-09-01 Mcafee, Inc. System, method and computer program product for automatically summarizing security events
EP2382575A4 (fr) * 2009-01-29 2013-05-22 Hewlett Packard Development Co Gestion de sécurité dans un réseau
JP2016006553A (ja) * 2013-01-25 2016-01-14 パナソニック株式会社 情報提供方法、情報管理システムおよび端末機器の制御方法
US10469514B2 (en) * 2014-06-23 2019-11-05 Hewlett Packard Enterprise Development Lp Collaborative and adaptive threat intelligence for computer security
JP2016122273A (ja) 2014-12-24 2016-07-07 富士通株式会社 アラート発信方法、プログラム、及び装置
US10887347B2 (en) * 2016-10-27 2021-01-05 Radware, Ltd. Network-based perimeter defense system and method
US10534917B2 (en) * 2017-06-20 2020-01-14 Xm Cyber Ltd. Testing for risk of macro vulnerability

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
None *

Also Published As

Publication number Publication date
US20180063172A1 (en) 2018-03-01
JP6690469B2 (ja) 2020-04-28
JP2018032356A (ja) 2018-03-01
SG10201706105WA (en) 2018-03-28
EP3288233A1 (fr) 2018-02-28
US10560467B2 (en) 2020-02-11

Similar Documents

Publication Publication Date Title
US10348747B2 (en) Non-transitory computer-readable recording medium storing cyber attack analysis support program, cyber attack analysis support method, and cyber attack analysis support device
US10476904B2 (en) Non-transitory recording medium recording cyber-attack analysis supporting program, cyber-attack analysis supporting method, and cyber-attack analysis supporting apparatus
US10958690B1 (en) Security appliance to monitor networked computing environment
EP3288233B1 (fr) Programme de commande de stockage de supports d'enregistrement lisibles par ordinateur non transitoires, procédé de commande et dispositif de traitement d'informations
US10333986B2 (en) Conditional declarative policies
US20240054234A1 (en) Methods and systems for hardware and firmware security monitoring
US9697352B1 (en) Incident response management system and method
US9853994B2 (en) Attack analysis system, cooperation apparatus, attack analysis cooperation method, and program
CN105324778B (zh) 用于把虚拟机分派给安全容器的方法、系统和装置
CN103493061B (zh) 用于应对恶意软件的方法和装置
JP2019519018A (ja) ネットワーク化コンピュータシステムアーキテクチャにおけるセキュリティリスクを低減させるための方法および装置
EP2860657B1 (fr) Déterminer un état de sécurité de fichiers potentiellement malveillants
US11455389B2 (en) Evaluation method, information processing apparatus, and storage medium
JP7255636B2 (ja) 端末管理装置、端末管理方法、およびプログラム
Laurén et al. Virtual machine introspection based cloud monitoring platform
EP2827270A1 (fr) Terminal d'informations portable et programme
JP2019200467A (ja) ログ情報収集分析システム
RU2571725C2 (ru) Система и способ управления параметрами приложений на компьютерных устройствах пользователя
Halsey et al. Getting Advanced Information
KR20010082488A (ko) 로컬 네트워크 환경에서 금지 프로그램의 실행을 방지하는방법
JP2024046098A (ja) 情報管理装置および情報管理プログラム

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: REQUEST FOR EXAMINATION WAS MADE

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

AX Request for extension of the european patent

Extension state: BA ME

17P Request for examination filed

Effective date: 20180209

RBV Designated contracting states (corrected)

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20190528

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 29/06 20060101AFI20200122BHEP

Ipc: G06F 21/55 20130101ALI20200122BHEP

Ipc: G06F 21/57 20130101ALI20200122BHEP

INTG Intention to grant announced

Effective date: 20200218

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602017015543

Country of ref document: DE

REG Reference to a national code

Ref country code: AT

Ref legal event code: REF

Ref document number: 1265017

Country of ref document: AT

Kind code of ref document: T

Effective date: 20200515

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20200429

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG4D

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200829

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200730

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200831

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1265017

Country of ref document: AT

Kind code of ref document: T

Effective date: 20200429

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: BG

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200729

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602017015543

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20210201

REG Reference to a national code

Ref country code: BE

Ref legal event code: MM

Effective date: 20200731

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LI

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200731

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200728

Ref country code: CH

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200731

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: BE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200731

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IE

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20200728

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602017015543

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: H04L0029060000

Ipc: H04L0065000000

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: TR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: MT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

Ref country code: CY

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: MK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20200429

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230620

Year of fee payment: 7

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20230608

Year of fee payment: 7

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20230531

Year of fee payment: 7